ISO 13485 Certification for Medical Device Quality Management Systems
Accredited ISO 13485 certification from a UAF-accredited certification body in Dallas–Fort Worth, Texas, for medical device manufacturers, suppliers, and service providers. One senior auditor, one fixed-fee proposal, and a certification audit that typically takes 6–12 weeks.
Page reviewed 28 September 2026 by the Accredify Global certification team.
What Is ISO 13485 Certification?
ISO 13485 certification is independent confirmation, by an accredited certification body, that your quality management system for medical devices meets ISO 13485. It shows OEMs, distributors, and buyers that design, production, suppliers, complaints, and corrective action are controlled with regulatory requirements in mind.
ISO 13485 builds on the process approach familiar from ISO 9001 but is stricter. It expects documented procedures, risk management across the product lifecycle, validated processes, traceability, and feedback that reaches regulators when it has to. Our audit follows a device or component from design input through production, release, and post-market feedback.
We certify US organizations from our Dallas–Fort Worth, Texas headquarters and audit sites across 71 countries. Certify ISO 13485 on its own or with ISO 9001, ISO 14001, or ISO 27001.
ISO 13485 and the FDA QMSR: What Changed on 2 February 2026
The FDA's Quality Management System Regulation (QMSR) took effect on 2 February 2026. It replaces most of the old Quality System Regulation in 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. For US device manufacturers, a QMS built to ISO 13485 is now the regulatory baseline, not just a customer preference.
The FDA is clear on one point: it will not require or issue ISO 13485 certificates. A certificate also does not exempt a manufacturer from FDA inspection. Accredited certification still matters for OEM supplier qualification, distributors, tenders, and markets outside the US. ISO 13485:2016 remains the current edition, and ISO is reviewing it, so we will plan any future transition into your audit cycle.
Sources: FDA: QMSR frequently asked questions · ISO 13485:2016 (iso.org)
When Do Organizations Need ISO 13485 Certification?
Most ISO 13485 projects start when an OEM, distributor, tender, or regulator asks for proof of a medical device QMS.
Component suppliers and contract manufacturers are often required to hold an accredited ISO 13485 certificate before they can be approved.
Many national registration and tender processes ask for an accredited ISO 13485 certificate as part of the submission.
Growing device companies use ISO 13485 to formalize design control and risk management before products scale.
A controlled route from complaint to investigation, CAPA, and regulatory reporting where required.
One QMS standard across plants, so production records, releases, and nonconformances are handled the same way.
Sterilization, cleaning, and other special processes need validation evidence that stands up to audit.
What ISO 13485 Certification Does, and Doesn't Do, for Market Access
ISO 13485 is the common language of medical device regulators, but each market has its own route. Here's where an accredited certificate fits.
| Market or buyer | What is required | Where ISO 13485 certification fits |
|---|---|---|
| United States (FDA) | Compliance with the QMSR, verified through FDA inspection | The QMSR is built on ISO 13485:2016, but the FDA does not accept certificates in place of inspection. |
| European Union (MDR / IVDR) | Conformity assessment by a notified body for most device classes | A QMS built to ISO 13485 is the usual basis, but the notified body carries out its own QMS assessment. |
| Canada, Australia, Brazil, Japan | MDSAP audits, required for most Health Canada licences | MDSAP audits are performed by recognized MDSAP auditing organizations and cover ISO 13485 plus local rules. |
| OEMs, distributors & tenders | Supplier approval and tender qualification | An accredited ISO 13485 certificate is often exactly what is asked for, and is what we issue. |
Unsure which route applies to your device and markets? Tell us at scope review, and we'll confirm whether an accredited ISO 13485 certificate is the right deliverable before you commit.
How to Get ISO 13485 Certified
Six stages from first call to certificate, with the same senior auditor at every audit stage.
Not sure whether your design files, supplier controls, or validation records would pass Stage 1? A free scope review tells you before the auditor does.
Book a free audit scope reviewWhat Makes an ISO 13485 Audit at Accredify Global Different
The questions buyers ask most when comparing ISO 13485 certification bodies, answered upfront.
The auditor who scopes your certification leads Stage 1, Stage 2, and surveillance. Findings cite the evidence and the ISO 13485 clause behind them, so quality and regulatory teams can act on them.
We trace real records: design inputs and verification, supplier approvals, production and release records, complaints, and CAPA. That's the evidence OEMs and distributors want to see behind a certificate.
We tell you upfront what an accredited ISO 13485 certificate will and won't cover for FDA, EU MDR, and MDSAP markets. That way the certificate matches what your customer or market asks for.
Already certified elsewhere? A transfer audit reviews your certificate and any open nonconformities, then aligns your audit cycle without resetting your certification history.
ISO 13485 Certification Requirements: What the Audit Evaluates
Auditors follow the product lifecycle and check that each step is controlled, recorded, and linked to risk.
QMS & documentation
A defined scope with justified exclusions, documented procedures, and a medical device file for each device type or family.
Management responsibility
Quality policy, objectives, a management representative, and management reviews that act on feedback and audit results.
Resources & work environment
Competence records, infrastructure maintenance, and control of the work environment and contamination where it matters.
Design & development
Planning, inputs, outputs, reviews, verification, validation, transfer, and design changes, kept in a design and development file.
Purchasing & production
Supplier evaluation, purchasing controls, process validation, identification, traceability, and sterile-product requirements where relevant.
Feedback, complaints & CAPA
Feedback and complaint handling, reporting to regulators where required, internal audit, and corrective and preventive action.
Records the auditor will ask for
- Quality manual, QMS scope, and justified exclusions
- Medical device file for each device type or family
- Risk management file, typically aligned with ISO 14971
- Design and development plans, reviews, and verification records
- Supplier evaluation and purchasing records
- Process validation, including sterilization and software where used
- Production, traceability, and release records
- Complaint files, CAPA, and internal audit results
- Management review records
How ISO 13485 differs from ISO 9001
- Regulatory focus — built around meeting regulatory requirements, not customer satisfaction
- More documentation — many more documented procedures and records
- Risk across the lifecycle — product risk management, not just business risk
- Validation & traceability — process validation, sterility, and device traceability
- Post-market duties — complaint handling and regulatory reporting
See the clause-by-clause comparison in ISO 13485 vs ISO 9001.
ISO 13485 Certification Cost and Timeline
ISO 13485 certification doesn't have a list price. The fee follows the number of audit man-days your scope needs. That depends mostly on headcount, sites, device types, and processes such as design and sterilization. A free scope review gives you one fixed-fee proposal for your real scope, with no hidden costs added later.
What sets your audit man-days (and fee)
- Employees within the QMS scope, across all shifts
- Number of sites, and which activities each one performs
- Device types and risk, and whether design is in scope
- Special processes such as sterilization, and outsourced processes
- Whether you certify ISO 13485 alone or with ISO 9001, ISO 14001, or ISO 27001
Typical certification audit timeline
| Mature documented controls | 6–8 weeks |
|---|---|
| Moderate management maturity | 8–10 weeks |
| Multi-site or complex scope | 10–12 weeks |
These timelines cover the certification audit once your QMS is documented and in use, with records to show. Organizations starting from scratch need implementation time first.
ISO 13485 vs ISO 9001, ISO 14971, and MDSAP
How ISO 13485 relates to the standards and programs it's most often confused with.
| Standard or program | What it covers | How it relates to ISO 13485 |
|---|---|---|
| ISO 9001 | General quality management | Similar process approach, but ISO 13485 adds regulatory, risk, validation, and traceability requirements. |
| ISO 14971 | Risk management for medical devices | Not certified on its own here. It is the usual method for the risk management ISO 13485 requires. |
| MDSAP | A single audit for several regulators | Covers ISO 13485 plus country rules, and is run only by recognized MDSAP auditing organizations. |
| ISO 14001 & ISO 27001 | Environment and information security | Often added for manufacturing sites and connected or software devices, in one audit program. |
How to Choose Between ISO 13485 Certification Companies
The questions worth asking any ISO 13485 certification body before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Are you accredited, and can I verify it? | Yes. We're UAF-accredited under the IAF MLA framework. Check our scope in the UAF directory, and any certificate we issue on IAF CertSearch. |
| Will the certificate satisfy my customer or market? | We check what your OEM, distributor, tender, or regulator asks for at scope review, before you commit. |
| Are you a notified body or MDSAP auditing organization? | No. We issue accredited ISO 13485 certificates. EU MDR conformity assessment and MDSAP audits need those specific bodies. |
| Who actually leads the audit? | One dedicated senior auditor, from the scope call to the certificate and on through surveillance. |
| How is the audit priced? | One fixed fee, set by the audit man-days your scope requires. No hidden costs are added after you agree it. |
| Can we transfer from another body? | Yes. A transfer audit keeps your certification history and aligns the audit cycle. |
How to Check Whether a Company Is ISO 13485 Certified
Before approving an ISO 13485 certified company as a supplier, check the certificate itself rather than a logo on a website. Search the company on IAF CertSearch, which lists certificates issued by accredited certification bodies. For certificates we issue, use our certificate verification page.
Then read the scope. Make sure it covers the products, activities, and sites you are buying from, and that the certificate is in date. Finally, confirm the certification body is accredited for ISO 13485. The same checks apply to any list of ISO 13485 certified companies you are given.
What You Receive
Covering your defined scope and sites, valid for three years with annual surveillance.
Each finding linked to the evidence and the ISO 13485 clause behind it.
Customers can check your certificate on IAF CertSearch and our verification page.
Certificate and scope wording ready for OEM supplier approval and tenders.
Dates and focus areas for your annual surveillance audits, agreed upfront.
Add ISO 9001, ISO 14001, or ISO 27001 to the same audit program whenever you're ready.
Frequently Asked Questions About ISO 13485 Certification
Straight answers on cost, timeline, the FDA QMSR, EU MDR, and choosing a certification body.
What is ISO 13485 certification?
ISO 13485 certification is independent confirmation, by an accredited certification body, that an organization's quality management system for medical devices meets ISO 13485. It shows OEMs, distributors, and buyers that design, production, suppliers, complaints, and corrective action are controlled. It is verified through Stage 1 and Stage 2 audits.
Who needs ISO 13485 certification?
Medical device manufacturers, component and material suppliers, contract manufacturers, sterilization and other service providers, distributors, and software developers whose products fall under medical device rules. It is most often required by OEM supplier approval, distributors, tenders, and national registration processes.
What is the latest version of ISO 13485?
ISO 13485:2016 is the current edition. ISO is reviewing the standard, and any new edition would come with a transition period. Accredify Global plans any future transition into your existing audit cycle.
Does the FDA require ISO 13485 certification?
No. The FDA's Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference, so US manufacturers must meet its requirements. However, the FDA will not require or issue ISO 13485 certificates, and a certificate does not exempt a manufacturer from FDA inspection.
Is ISO 13485 certification enough for CE marking under EU MDR?
No. For most device classes, EU MDR and IVDR require conformity assessment by a notified body, which carries out its own QMS assessment. A QMS built to ISO 13485 is the usual basis for that assessment. Accredify Global is not a notified body.
Is Accredify Global an MDSAP auditing organization?
No. MDSAP audits, which most Health Canada licences require, are performed only by recognized MDSAP auditing organizations. Accredify Global issues accredited ISO 13485 certificates, which OEMs, distributors, tenders, and many national registration processes ask for.
How do I get ISO 13485 certified?
Define your QMS scope, implement the required procedures and records, and run the system long enough to complete an internal audit and management review. Then have an accredited certification body audit it. With Accredify Global the path is a free scope review, application, Stage 1, Stage 2, certification decision, and annual surveillance.
What are the ISO 13485 certification requirements?
ISO 13485 requires a documented QMS with a medical device file, management responsibility, and resource and work environment controls. It also requires controlled design and development, purchasing, production, validation, and traceability. Feedback, complaint handling, regulatory reporting, internal audit, and CAPA complete the system, with risk management applied throughout.
How much does ISO 13485 certification cost?
ISO 13485 certification cost depends on the number of audit man-days your scope requires. The main drivers are headcount, number of sites, device types, whether design is in scope, and special processes such as sterilization. Accredify Global reviews your scope for free and issues one fixed-fee proposal, with no hidden costs added afterwards.
How long does ISO 13485 certification take?
The certification audit typically takes 6 to 12 weeks. That is 6–8 weeks for mature documented controls, 8–10 weeks for moderate maturity, and 10–12 weeks for multi-site or complex scopes. Organizations starting from scratch need implementation time before the audit.
How long is an ISO 13485 certificate valid for?
Three years. Annual surveillance audits during that period confirm the QMS is still maintained, and a recertification audit is required before the certificate expires.
What is the difference between ISO 13485 and ISO 9001?
ISO 13485 is built around meeting regulatory requirements for medical devices, while ISO 9001 focuses on customer satisfaction and continual improvement. ISO 13485 requires more documented procedures, product risk management, process validation, traceability, and complaint handling with regulatory reporting.
What is an ISO 13485 certification body?
An ISO 13485 certification body is an independent organization that audits medical device quality management systems and issues ISO 13485 certificates. Choose one accredited for ISO 13485 under the IAF MLA framework, so customers can verify the certificate on IAF CertSearch.
How can I check if a company is ISO 13485 certified?
Search the company on IAF CertSearch, or on the issuing certification body's verification page. Then check that the certificate is valid and that its scope covers the products, activities, and site you are buying from.
Can ISO 13485 audits be done remotely?
Parts can. Document review and some interviews can be remote, depending on scope and risk. Production, sterilization, and other site activities usually need on-site audit time. We confirm the format at scope review.
Can I switch to Accredify Global if I'm already ISO 13485 certified?
Yes. This is a transfer audit, not a first-time certification. We review your existing certificate, scope, and any open nonconformities, then align your audit cycle. It follows IAF transfer guidance and does not reset your certification history.
Can ISO 13485 be combined with other standards?
Yes. ISO 13485 can be audited in one program with ISO 9001, ISO 14001, or ISO 27001. This reduces repeated audit time for shared processes such as document control, internal audit, and management review.
Get One Fixed-Fee Proposal for Your Actual Device Scope
Tell us about your devices, sites, and the OEM, tender, or market asking for ISO 13485. We'll confirm the certificate is the right deliverable, recommend a timeline, and return a fixed-fee proposal.
Book your free audit scope review →